Keycyte PAM 3.2 · Administrator Guide
Password Roles
A password role gives a set of users access to a set of password vault accounts. A user can connect to a server with an account only if a password role grants the account and a server role grants the server. Password roles also decide which accounts a service identity can retrieve through the Secrets API.
To open the page, select Roles > Password Roles.
Before you begin, make sure that you have the Add permission for Password Roles and that the accounts exist in the password vault.
Creating a Password Role
To create a password role:
- Select Roles > Password Roles.
- Click Add. The Password Role panel opens.
- Optionally select Tags, and enter a Name.
- Select the features of the role. See Password Role Features.
- Move the accounts of the role from Non-Member to Member.
- Click Save.
- Authorize users and groups: click … in the row of the role, select Authorization, add users under Authorized Users and groups under Groups, and click Save. The search works as for server roles; see Server Roles.
Password Role Features
All features are cleared by default.
| Feature | Description |
|---|---|
| Session Record | Records the sessions that use the role’s accounts. A session is recorded if either a server role or a password role that applies to it requires recording. |
| Password Copy | Lets users copy the password of the account in the Client Panel. Without it, users connect with the account without seeing its password. |
| Account Lock | Lets only one session use the account at a time. While a session is open with the account, other users cannot connect with it and see who is using it. |
| Username Disable | Hides the user name of the account from users in the Client Panel. |
| Approve | Users must request access to the account and have the request approved before they can connect with it. See Access Requests. |
| MFA | Users must enter an MFA code before each connection with the account. |
| Owner | Marks the authorized users and groups of the role as its owners. |
| Notify On Use | Sends an e-mail to the owners of the account every time its password is fetched for a connection. |
| Notify On Copy | Sends an e-mail to the owners of the account every time its password is copied. |
Changing the Accounts of a Role
To change the accounts of a role, either edit the role, or click … in its row, select Accounts, move accounts between Non-Member and Member, and click Save.
The Members column shows how many accounts the role has; click it to expand the row and see them.
Schedule, Bulk Actions and Owners
Password roles have the same Schedule, Owners and Bulk actions as server roles. Outside its schedule, a password role grants no access. For details, see Server Roles.
Deleting a Password Role
To delete a role, click … in its row, select Delete and confirm. You need the Delete permission for Password Roles.